CVE-2012-5378

CVE-2012-5378 describes an untrusted search path vulnerability in ActiveTcl 8.5.12, specifically when installed in the C:\ directory. This flaw allows a local, authenticated attacker to gain privileges by placing a malicious DLL, such as a Trojan horse wlbsctrl.dll, in the C:\TD\bin directory, which is then added to the system PATH and loaded by services like "IKE and AuthIP IPsec Keying Modules" on affected Windows versions. With a CVSS score of 6.0 (AV:L/AC:H/Au:S/C:C/I:C/A:C), this vulnerability has high impact on confidentiality, integrity, and availability, but requires local access and high attack complexity. While not listed on CISA's KEV catalog and with no active exploitation or significant community discussion, a Metasploit module exists for a related missing DLL vulnerability, indicating potential for exploitation.